UACME

UACMe Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. This project demonstrates various UAC bypass techniques and serves as an educational resource for understanding Windows security mechanisms. ⚠️ Warning : This tool demonstrates security vulnerabilities...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

SnafflerParser

Snaffler Output File Parser Especially in large environments, the Snaffler output gets very large and time-consuming to analyze. This script parses the Snaffler output file TSV format required and: Beautifies results into readable tables and exports to TXT, CSV, HTML, JSON or PS Gridview. Generat...

Nosql-MongoDB-injection-username-password-enumeration

Nosql injection username and password enumeration script Using this script, we can enumerate Usernames and passwords of Nosqlmongodb injecion vulnerable web applications. Exploit Title: Nosql injection username/password enumeration. Author: Kalana Sankalpa Anon LK. Website:...

androwarn

Androwarn Yet another static code analyzer for malicious Android applications Description Androwarn is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application. The detection is performed with the static analysis of the...

QLinspector

QLinspector Finding Java/C gadget chains with CodeQL. More information in our article Installation Clone the repo $ git clone https://github.com/synacktiv/QLinspector.git Search for gadgets: $ codeql database analyze log4j --format=sarif-latest --output=log4j.sarif --search-path=./QLinspector/...

Collabfiltrator

Collabfiltrator Exfiltrate Blind Remote Code Execution and SQL injection output over DNS via Burp Collaborator. Version: 4.0.1 Authors: Adam Logue Jared McLaren Frank Scarpella Ryan Griffin AI Authors: Claude 3.5 Sonnet ChatGPT 4o Requirements: Burp Suite Professional 2024.12.1 or Later Support:...

dnsviz

Table of Contents Installation Usage Pre-Deployment DNS Testing Docker Container Description DNSViz is a tool suite for analysis and visualization of Domain Name System DNS behavior, including its security extensions DNSSEC. This tool suite powers the Web-based analysis available at...

WSMan-WinRM

WSMan-WinRM A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object. Background For background information, please refer to the following blog post: WS-Management COM: Another Approach for WinRM Lateral Movement Notes...

extractTVpasswords

Extract password from TeamViewer memory using Frida CVE-2018-14333 Hi there, in this article we want to tell about our little research about password security in TeamViewer. The method can help during the pentest time for post exploitation to get access to another machine using TeamViewer...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Update 31/05/2022 - CVE-2022-30190 - Follina Now the generator is able to generate the document required to exploit also the "Follina"...

zeroboot

Sub-millisecond VM sandboxes for AI agents via copy-on-write forking Try it curl -X POST https://api.zeroboot.dev/v1/exec \ -H 'Content-Type: application/json' \ -H 'Authorization: Bearer zbdemohn2026' \ -d '"code":"import numpy as np; printnp.random.rand3"' Benchmarks Metric| Zeroboot| E2B|...

dotdotpwn

DESCRIPTION DotDotPwn - The Directory Traversal Fuzzer It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc. Also, it has a protocol-independent module to send the desired...

Invoke-WCMDump

Invoke-WCMDump PowerShell script to dump Windows credentials from the Credential Manager Invoke-WCMDump enumerates Windows credentials in the Credential Manager and then extracts available information about each one. Passwords are retrieved for "Generic" type credentials, but can not be retrived ...

noPac

About Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user Changed from sam-the-admin. Usage SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain positional arguments: domain/username:password Account used to authenticate to DC. options: -h, --help show this hel...

OSCP-Exam-Report-Template-Markdown

Offensive Security Exam Report Template in Markdown I created an Offensive Security Exam Report Template in Markdown so LaTeX, Microsoft Office Word, LibreOffice Writer are no longer needed during your Offensive Security OSCP, OSWE, OSEE, OSWP, OSEP, OSED, OSWA, OSDA, OSMR, OSTH, OSIR exam! Now y...

LANs.py

LANs.py NOTE I do not maintain this anymore. I highly suggest using bettercap instead for ARP and MITM needs. Automatically find the most active WLAN users then spy on one of them and/or inject arbitrary HTML/JS into pages they visit. Individually poisons the ARP tables of the target box, the...

pbtk

pbtk - Reverse engineering Protobuf apps Protobuf is a serialization format developed by Google and used in an increasing number of Android, web, desktop and more applications. It consists of a language for declaring data structures , which is then compiled to code or another kind of structure...

Glass

Glass as in transparent and smooth A fast, native, mobile-app first interactive disassembler. Spiritual successor to IDA Pro for the Android / iOS reverse engineering workflow, built around: smali for APK / DEX / smali handling armv8-encode for AArch64 and ARMv7 A32 / Thumb — native .so, iOS Mach...